8.8

CVE-2022-40677

A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted input parameters.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ Fortinac Version >= 8.5.0 <= 8.5.4
Fortinet ≫ Fortinac Version >= 8.6.0 <= 8.6.5
Fortinet ≫ Fortinac Version >= 8.7.0 <= 8.7.6
Fortinet ≫ Fortinac Version >= 8.8.0 <= 8.8.11
Fortinet ≫ Fortinac Version >= 9.1.0 <= 9.1.7
Fortinet ≫ Fortinac Version >= 9.2.0 <= 9.2.5
Fortinet ≫ Fortinac Version8.3.7
Fortinet ≫ Fortinac Version9.4.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.574
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
psirt@fortinet.com 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.